<!DOCTYPE html>
<html xmlns="http://www.w3.org/1999/xhtml">
    <head>
        <meta
            http-equiv="Content-Type"
            content="text/html; charset=utf-8"
        />
        <meta name="viewport" content="width=device-width, initial-scale=1" />

        <title>Audit Logs API Client &mdash; Python Slack SDK</title>

        <!-- Google Tag Manager -->
        <script>
            (function(w, d, s, l, i) {
                w[l] = w[l] || [];
                w[l].push({
                    'gtm.start': new Date().getTime(),
                    event: 'gtm.js'
                });
                var f = d.getElementsByTagName(s)[0],
                    j = d.createElement(s),
                    dl = l != 'dataLayer' ? '&l=' + l : '';
                j.async = true;
                j.src = 'https://www.googletagmanager.com/gtm.js?id=' + i + dl;
                f.parentNode.insertBefore(j, f);
            })(window, document, 'script', 'dataLayer', 'GTM-KFZ5MK7');
        </script>
        <!-- End Google Tag Manager -->
        
        <link
            href="https://a.slack-edge.com/4f227/style/rollup-slack_kit_legacy_adapters.css"
            rel="stylesheet"
            type="text/css"
        />
        <link
            href="https://a.slack-edge.com/3e02c0/style/rollup-api_site.css"
            rel="stylesheet"
            type="text/css"
        />
        <link
            rel="stylesheet"
            href=".././assets/default.css"
            type="text/css"
        />
        <link
            rel="stylesheet"
            href=".././assets/pygments.css"
            type="text/css"
        />
        <link
            rel="stylesheet"
            href=".././assets/docs.css"
            type="text/css"
        />
        <link
            id="favicon"
            rel="shortcut icon"
            href="https://a.slack-edge.com/4f28/img/icons/favicon-32.png"
            type="image/png"
        />
        <link
            rel="top"
            title="Python Slack SDK 1.0.1 documentation"
            href="../index.html"
        />
    </head>

    <body class="api light_theme">
        <!-- Google Tag Manager (noscript) -->
        <noscript
            ><iframe
                src="https://www.googletagmanager.com/ns.html?id=GTM-KFZ5MK7"
                height="0"
                width="0"
                style="display:none;visibility:hidden"
            ></iframe
        ></noscript>
        <!-- End Google Tag Manager (noscript) -->
        <header>
            <a id="menu_toggle" class="no_transition show_on_mobile">
                <span class="menu_icon"></span>
                <span class="vert_divider"></span>
            </a>
            <a
                href="https://api.slack.com/"
                id="header_logo"
                class="api hide_on_mobile"
                style="float:left; display: inline-block;"
            >
                <img
                    alt="Slack API"
                    src="https://a.slack-edge.com/3026cb/img/slack_api_logo_vogue.png"
                    style="width: 225px; padding-right: 25px; border-right: 1px solid #DDD;"
                />
            </a>
            <span
                style="display: inline-block; padding-left: 20px; margin-top: 25px; font-weight: bold;"
            >
                <a style="color: #555459;" href="./index.html">Python Slack SDK</a>
            </span>
            <div class="header_nav">
                <a
                    href="https://github.com/SlackAPI/python-slack-sdk"
                    class="btn header_btn float_right"
                    data-qa="go_to_slack"
                    >Go to GitHub</a
                >
            </div>
        </header>
        

        <div id="page">
            <div id="page_contents" class="clearfix">
                <!-- Sidebar Content -->
                <nav id="api_nav" class="col span_1_of_4">
                    <div id="api_sections">
                         <ul class="current">
<li class="toctree-l1"><a class="reference internal" href="../index.html">Python Slack SDK</a></li>
<li class="toctree-l1"><a class="reference internal" href="../v3-migration/index.html">Migration Guide</a><ul>
<li class="toctree-l2"><a class="reference internal" href="../v3-migration/index.html#from-slackclient-2-x">From slackclient 2.x</a></li>
<li class="toctree-l2"><a class="reference internal" href="../v3-migration/index.html#from-slackclient-1-x">From slackclient 1.x</a></li>
</ul>
</li>
<li class="toctree-l1"><a class="reference internal" href="../installation/index.html">Installation</a><ul>
<li class="toctree-l2"><a class="reference internal" href="../installation/index.html#access-tokens">Access Tokens</a></li>
<li class="toctree-l2"><a class="reference internal" href="../installation/index.html#workspace-installations">Workspace Installations</a></li>
</ul>
</li>
<li class="toctree-l1"><a class="reference internal" href="../web/index.html">Web Client</a><ul>
<li class="toctree-l2"><a class="reference internal" href="../web/index.html#messaging">Messaging</a></li>
<li class="toctree-l2"><a class="reference internal" href="../web/index.html#files">Files</a></li>
<li class="toctree-l2"><a class="reference internal" href="../web/index.html#conversations">Conversations</a></li>
<li class="toctree-l2"><a class="reference internal" href="../web/index.html#modals">Modals</a></li>
<li class="toctree-l2"><a class="reference internal" href="../web/index.html#rate-limits">Rate Limits</a><ul>
<li class="toctree-l3"><a class="reference internal" href="../web/index.html#calling-any-api-methods">Calling any API methods</a></li>
</ul>
</li>
<li class="toctree-l2"><a class="reference internal" href="../web/index.html#asyncwebclient">AsyncWebClient</a></li>
<li class="toctree-l2"><a class="reference internal" href="../web/index.html#retryhandler">RetryHandler</a></li>
</ul>
</li>
<li class="toctree-l1"><a class="reference internal" href="../webhook/index.html">Webhook Client</a><ul>
<li class="toctree-l2"><a class="reference internal" href="../webhook/index.html#id1">Incoming Webhooks</a></li>
<li class="toctree-l2"><a class="reference internal" href="../webhook/index.html#response-url">response_url</a></li>
<li class="toctree-l2"><a class="reference internal" href="../webhook/index.html#asyncwebhookclient">AsyncWebhookClient</a></li>
<li class="toctree-l2"><a class="reference internal" href="../webhook/index.html#retryhandler">RetryHandler</a></li>
</ul>
</li>
<li class="toctree-l1"><a class="reference internal" href="../socket-mode/index.html">Socket Mode Client</a><ul>
<li class="toctree-l2"><a class="reference internal" href="../socket-mode/index.html#socketmodeclient">SocketModeClient</a></li>
<li class="toctree-l2"><a class="reference internal" href="../socket-mode/index.html#supported-libraries">Supported Libraries</a></li>
<li class="toctree-l2"><a class="reference internal" href="../socket-mode/index.html#asyncio-based-libraries">Asyncio Based Libraries</a></li>
</ul>
</li>
<li class="toctree-l1"><a class="reference internal" href="../oauth/index.html">OAuth Modules</a><ul>
<li class="toctree-l2"><a class="reference internal" href="../oauth/index.html#app-installation-flow">App Installation Flow</a></li>
<li class="toctree-l2"><a class="reference internal" href="../oauth/index.html#token-lookup">Token Lookup</a></li>
<li class="toctree-l2"><a class="reference internal" href="../oauth/index.html#sign-in-with-slack">Sign in with Slack</a></li>
</ul>
</li>
<li class="toctree-l1 current"><a class="current reference internal" href="#">Audit Logs API Client</a><ul>
<li class="toctree-l2"><a class="reference internal" href="#auditlogsclient">AuditLogsClient</a></li>
<li class="toctree-l2"><a class="reference internal" href="#asyncauditlogsclient">AsyncAuditLogsClient</a></li>
<li class="toctree-l2"><a class="reference internal" href="#retryhandler">RetryHandler</a></li>
</ul>
</li>
<li class="toctree-l1"><a class="reference internal" href="../scim/index.html">SCIM API Client</a><ul>
<li class="toctree-l2"><a class="reference internal" href="../scim/index.html#scimclient">SCIMClient</a></li>
<li class="toctree-l2"><a class="reference internal" href="../scim/index.html#asyncscimclient">AsyncSCIMClient</a></li>
<li class="toctree-l2"><a class="reference internal" href="../scim/index.html#retryhandler">RetryHandler</a></li>
</ul>
</li>
<li class="toctree-l1"><a class="reference internal" href="../real_time_messaging.html">RTM Client</a><ul>
<li class="toctree-l2"><a class="reference internal" href="../real_time_messaging.html#real-time-messaging-rtm">Real Time Messaging (RTM)</a></li>
</ul>
</li>
<li class="toctree-l1"><a class="reference internal" href="../faq.html">FAQ</a><ul>
<li class="toctree-l2"><a class="reference internal" href="../faq.html#python-documents">Python Documents</a></li>
<li class="toctree-l2"><a class="reference internal" href="../faq.html#installation-issues">Installation Issues</a></li>
<li class="toctree-l2"><a class="reference internal" href="../faq.html#bug-report">Bug Report</a></li>
<li class="toctree-l2"><a class="reference internal" href="../faq.html#feature-requests">Feature Requests</a></li>
<li class="toctree-l2"><a class="reference internal" href="../faq.html#contributions">Contributions</a></li>
<li class="toctree-l2"><a class="reference internal" href="../faq.html#documentation">Documentation</a></li>
</ul>
</li>
<li class="toctree-l1"><a class="reference internal" href="../about.html">About</a><ul>
<li class="toctree-l2"><a class="reference internal" href="../about.html#product-name">Python Slack SDK</a></li>
</ul>
</li>
</ul>


<div id="footer">

        <ul id="footer_nav">
                <li><a href="https://github.com/SlackAPI/python-slack-sdk/blob/main/LICENSE">License</a></li>
                <li><a href="https://slackhq.github.io/code-of-conduct">Code of Conduct</a></li>
                <li><a href="https://github.com/slackapi/python-slack-sdk/blob/main/.github/contributing.md">Contributing</a></li>
                <li><a href="https://docs.google.com/a/slack-corp.com/forms/d/e/1FAIpQLSfzjVoCM7ohBnjWf7eDYQxzti1EPpinsIJQA5RAUBwJKRUQHg/viewform">Contributor License Agreement</a></li>
        </ul>

        <p id="footer_signature">Made with <i class="ts_icon ts_icon_heart"></i> by Slack<br/>and our Lovely
                Community
        </p>
</div> 
                    </div>
                </nav>
                <!-- /Sidebar Content -->

                <!-- Body Content -->
                <div class="col span_3_of_4">
                    <!-- <div class="section-title">Audit Logs API Client</div> -->
                    <div class="card">
  <section id="audit-logs-api-client">
<h1>Audit Logs API Client<a class="headerlink" href="#audit-logs-api-client" title="Link to this heading">¶</a></h1>
<p><a class="reference external" href="https://api.slack.com/admins/audit-logs">Audit Logs API</a> is a set of APIs for monitoring what’s happening in your <a class="reference external" href="https://api.slack.com/enterprise/grid">Enterprise Grid</a> organization.</p>
<p>The Audit Logs API can be used by security information and event management (SIEM) tools to provide an analysis of how your Slack organization is being accessed. You can also use this API to write your own applications to see how members of your organization are using Slack.</p>
<p>Follow the instructions in <a class="reference external" href="https://api.slack.com/admins/audit-logs">the API document</a> to get a valid token for using Audit Logs API. The Slack app using the Audit Logs API needs to be installed in the Enterprise Grid Organization, not an individual workspace within the organization.</p>
<p>The Python document for this module is available at <a class="reference external" href="https://slack.dev/python-slack-sdk/api-docs/slack_sdk/">https://slack.dev/python-slack-sdk/api-docs/slack_sdk/</a></p>
<section id="auditlogsclient">
<h2>AuditLogsClient<a class="headerlink" href="#auditlogsclient" title="Link to this heading">¶</a></h2>
<p>An OAuth token with <a class="reference external" href="https://api.slack.com/scopes/admin">the admin scope</a> is required to access this API.</p>
<p>You will likely use the <code class="docutils literal notranslate"><span class="pre">/logs</span></code> endpoint as it’s the essential part of this API.</p>
<p>To learn about the available parameters for this endpoint, check out <a class="reference external" href="https://api.slack.com/admins/audit-logs#how_to_call_the_audit_logs_api">this guide</a>. You can also learn more about the data structure of <code class="docutils literal notranslate"><span class="pre">api_response.typed_body</span></code> from <a class="reference external" href="https://github.com/slackapi/python-slack-sdk/blob/main/slack_sdk/audit_logs/v1/logs.py">the class source code</a>.</p>
<div class="highlight-python notranslate"><div class="highlight"><pre><span></span><span class="kn">import</span> <span class="nn">os</span>
<span class="kn">from</span> <span class="nn">slack_sdk.audit_logs</span> <span class="kn">import</span> <span class="n">AuditLogsClient</span>

<span class="n">client</span> <span class="o">=</span> <span class="n">AuditLogsClient</span><span class="p">(</span><span class="n">token</span><span class="o">=</span><span class="n">os</span><span class="o">.</span><span class="n">environ</span><span class="p">[</span><span class="s2">&quot;SLACK_ORG_ADMIN_USER_TOKEN&quot;</span><span class="p">])</span>

<span class="n">api_response</span> <span class="o">=</span> <span class="n">client</span><span class="o">.</span><span class="n">logs</span><span class="p">(</span><span class="n">action</span><span class="o">=</span><span class="s2">&quot;user_login&quot;</span><span class="p">,</span> <span class="n">limit</span><span class="o">=</span><span class="mi">1</span><span class="p">)</span>
<span class="n">api_response</span><span class="o">.</span><span class="n">typed_body</span>  <span class="c1"># slack_sdk.audit_logs.v1.LogsResponse</span>
</pre></div>
</div>
<p>If you would like to access <code class="docutils literal notranslate"><span class="pre">/schemes</span></code> or <code class="docutils literal notranslate"><span class="pre">/actions</span></code>, you can use the following methods:</p>
<div class="highlight-python notranslate"><div class="highlight"><pre><span></span><span class="n">api_response</span> <span class="o">=</span> <span class="n">client</span><span class="o">.</span><span class="n">schemas</span><span class="p">()</span>
<span class="n">api_response</span> <span class="o">=</span> <span class="n">client</span><span class="o">.</span><span class="n">actions</span><span class="p">()</span>
</pre></div>
</div>
</section>
<section id="asyncauditlogsclient">
<h2>AsyncAuditLogsClient<a class="headerlink" href="#asyncauditlogsclient" title="Link to this heading">¶</a></h2>
<p>If you are keen to use asyncio for SCIM API calls, we offer AsyncSCIMClient for it. This client relies on aiohttp library.</p>
<div class="highlight-python notranslate"><div class="highlight"><pre><span></span><span class="kn">from</span> <span class="nn">slack_sdk.audit_logs.async_client</span> <span class="kn">import</span> <span class="n">AsyncAuditLogsClient</span>
<span class="n">client</span> <span class="o">=</span> <span class="n">AsyncAuditLogsClient</span><span class="p">(</span><span class="n">token</span><span class="o">=</span><span class="n">os</span><span class="o">.</span><span class="n">environ</span><span class="p">[</span><span class="s2">&quot;SLACK_ORG_ADMIN_USER_TOKEN&quot;</span><span class="p">])</span>

<span class="n">api_response</span> <span class="o">=</span> <span class="k">await</span> <span class="n">client</span><span class="o">.</span><span class="n">logs</span><span class="p">(</span><span class="n">action</span><span class="o">=</span><span class="s2">&quot;user_login&quot;</span><span class="p">,</span> <span class="n">limit</span><span class="o">=</span><span class="mi">1</span><span class="p">)</span>
<span class="n">api_response</span><span class="o">.</span><span class="n">typed_body</span>  <span class="c1"># slack_sdk.audit_logs.v1.LogsResponse</span>
</pre></div>
</div>
</section>
<hr class="docutils" />
<section id="retryhandler">
<h2>RetryHandler<a class="headerlink" href="#retryhandler" title="Link to this heading">¶</a></h2>
<p>With the default settings, only <code class="docutils literal notranslate"><span class="pre">ConnectionErrorRetryHandler</span></code> with its default configuration (=only one retry in the manner of <a class="reference external" href="https://aws.amazon.com/blogs/architecture/exponential-backoff-and-jitter/">exponential backoff and jitter</a>) is enabled. The retry handler retries if an API client encounters a connectivity-related failure (e.g., Connection reset by peer).</p>
<p>To use other retry handlers, you can pass a list of <code class="docutils literal notranslate"><span class="pre">RetryHandler</span></code> to the client constructor. For instance, you can add the built-in <code class="docutils literal notranslate"><span class="pre">RateLimitErrorRetryHandler</span></code> this way:</p>
<div class="highlight-python notranslate"><div class="highlight"><pre><span></span><span class="kn">import</span> <span class="nn">os</span>
<span class="kn">from</span> <span class="nn">slack_sdk.audit_logs</span> <span class="kn">import</span> <span class="n">AuditLogsClient</span>
<span class="n">client</span> <span class="o">=</span> <span class="n">AuditLogsClient</span><span class="p">(</span><span class="n">token</span><span class="o">=</span><span class="n">os</span><span class="o">.</span><span class="n">environ</span><span class="p">[</span><span class="s2">&quot;SLACK_ORG_ADMIN_USER_TOKEN&quot;</span><span class="p">])</span>

<span class="c1"># This handler does retries when HTTP status 429 is returned</span>
<span class="kn">from</span> <span class="nn">slack_sdk.http_retry.builtin_handlers</span> <span class="kn">import</span> <span class="n">RateLimitErrorRetryHandler</span>
<span class="n">rate_limit_handler</span> <span class="o">=</span> <span class="n">RateLimitErrorRetryHandler</span><span class="p">(</span><span class="n">max_retry_count</span><span class="o">=</span><span class="mi">1</span><span class="p">)</span>

<span class="c1"># Enable rate limited error retries as well</span>
<span class="n">client</span><span class="o">.</span><span class="n">retry_handlers</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">rate_limit_handler</span><span class="p">)</span>
</pre></div>
</div>
<p>Creating your own ones is also quite simple. Defining a new class that inherits <code class="docutils literal notranslate"><span class="pre">slack_sdk.http_retry.RetryHandler</span></code> (<code class="docutils literal notranslate"><span class="pre">AsyncRetryHandler</span></code> for asyncio apps) and implements required methods (internals of <code class="docutils literal notranslate"><span class="pre">can_retry</span></code> / <code class="docutils literal notranslate"><span class="pre">prepare_for_next_retry</span></code>). Check the built-in ones’ source code for learning how to properly implement.</p>
<div class="highlight-python notranslate"><div class="highlight"><pre><span></span><span class="kn">import</span> <span class="nn">socket</span>
<span class="kn">from</span> <span class="nn">typing</span> <span class="kn">import</span> <span class="n">Optional</span>
<span class="kn">from</span> <span class="nn">slack_sdk.http_retry</span> <span class="kn">import</span> <span class="p">(</span><span class="n">RetryHandler</span><span class="p">,</span> <span class="n">RetryState</span><span class="p">,</span> <span class="n">HttpRequest</span><span class="p">,</span> <span class="n">HttpResponse</span><span class="p">)</span>
<span class="kn">from</span> <span class="nn">slack_sdk.http_retry.builtin_interval_calculators</span> <span class="kn">import</span> <span class="n">BackoffRetryIntervalCalculator</span>
<span class="kn">from</span> <span class="nn">slack_sdk.http_retry.jitter</span> <span class="kn">import</span> <span class="n">RandomJitter</span>

<span class="k">class</span> <span class="nc">MyRetryHandler</span><span class="p">(</span><span class="n">RetryHandler</span><span class="p">):</span>
    <span class="k">def</span> <span class="nf">_can_retry</span><span class="p">(</span>
        <span class="bp">self</span><span class="p">,</span>
        <span class="o">*</span><span class="p">,</span>
        <span class="n">state</span><span class="p">:</span> <span class="n">RetryState</span><span class="p">,</span>
        <span class="n">request</span><span class="p">:</span> <span class="n">HttpRequest</span><span class="p">,</span>
        <span class="n">response</span><span class="p">:</span> <span class="n">Optional</span><span class="p">[</span><span class="n">HttpResponse</span><span class="p">]</span> <span class="o">=</span> <span class="kc">None</span><span class="p">,</span>
        <span class="n">error</span><span class="p">:</span> <span class="n">Optional</span><span class="p">[</span><span class="ne">Exception</span><span class="p">]</span> <span class="o">=</span> <span class="kc">None</span>
    <span class="p">)</span> <span class="o">-&gt;</span> <span class="nb">bool</span><span class="p">:</span>
        <span class="c1"># [Errno 104] Connection reset by peer</span>
        <span class="k">return</span> <span class="n">error</span> <span class="ow">is</span> <span class="ow">not</span> <span class="kc">None</span> <span class="ow">and</span> <span class="nb">isinstance</span><span class="p">(</span><span class="n">error</span><span class="p">,</span> <span class="n">socket</span><span class="o">.</span><span class="n">error</span><span class="p">)</span> <span class="ow">and</span> <span class="n">error</span><span class="o">.</span><span class="n">errno</span> <span class="o">==</span> <span class="mi">104</span>

<span class="n">client</span> <span class="o">=</span> <span class="n">AuditLogsClient</span><span class="p">(</span>
    <span class="n">token</span><span class="o">=</span><span class="n">os</span><span class="o">.</span><span class="n">environ</span><span class="p">[</span><span class="s2">&quot;SLACK_ORG_ADMIN_USER_TOKEN&quot;</span><span class="p">],</span>
    <span class="n">retry_handlers</span><span class="o">=</span><span class="p">[</span><span class="n">MyRetryHandler</span><span class="p">(</span>
        <span class="n">max_retry_count</span><span class="o">=</span><span class="mi">1</span><span class="p">,</span>
        <span class="n">interval_calculator</span><span class="o">=</span><span class="n">BackoffRetryIntervalCalculator</span><span class="p">(</span>
            <span class="n">backoff_factor</span><span class="o">=</span><span class="mf">0.5</span><span class="p">,</span>
            <span class="n">jitter</span><span class="o">=</span><span class="n">RandomJitter</span><span class="p">(),</span>
        <span class="p">),</span>
    <span class="p">)],</span>
<span class="p">)</span>
</pre></div>
</div>
<p>For asyncio apps, <code class="docutils literal notranslate"><span class="pre">Async</span></code> prefixed corresponding modules are available. All the methods in those methods are async/await compatible. Check <a class="reference external" href="https://github.com/slackapi/python-slack-sdk/blob/main/slack_sdk/http_retry/async_handler.py">the source code</a> and <a class="reference external" href="https://github.com/slackapi/python-slack-sdk/blob/main/tests/slack_sdk_async/web/test_async_web_client_http_retry.py">tests</a> for more details.</p>
</section>
</section>


                        <div class="clear_both large_bottom_margin"></div>
                    </div>
                </div>
                <!-- /Body Content -->
            </div>
        </div>

        <footer>
            <p class="light tiny align_center">
                © 2015- Slack Technologies, LLC and contributors
            </p>
        </footer>

        <script>
            window.ga =
                window.ga ||
                function() {
                    (ga.q = ga.q || []).push(arguments);
                };
            ga.l = +new Date();
            ga('create', 'UA-56978219-13', 'auto');
            ga('send', 'pageview');
        </script>
        <script async src="https://www.google-analytics.com/analytics.js"></script>
    </body>
</html>